이 페이지에서는 IAP와 함께 사용할 OAuth 클라이언트를 프로그래매틱 방식으로 만들어 내부 애플리케이션에 프로그래매틱 방식으로 IAP를 설정하는 방법에 대해 설명합니다.
알려진 제한사항
이 API를 사용하여 프로그래매틱 방식으로 생성된 OAuth 클라이언트에는 몇 가지 제한사항이 있습니다.
API로 만든 OAuth 클라이언트는 API를 사용해야만 수정할 수 있습니다. API를 사용하여 만든 경우 Google Cloud Console을 통해 OAuth 클라이언트를 수정할 수 없습니다.
API로 만든 OAuth 클라이언트는 IAP 사용용으로만 잠겨 있으므로 API에서 리디렉션 URI 또는 기타 속성을 업데이트할 수 없습니다.
API는 Google Cloud console을 사용하여 만든 OAuth 클라이언트에서 작동하지 않습니다.
API 사용 시 프로젝트당 500개의 OAuth 클라이언트만 허용됩니다.
API로 만든 OAuth 동의 화면 브랜드에는 특정 제한이 있습니다. 자세한 내용은 아래 섹션을 참조하세요.
브랜드 및 브랜딩 상태 이해
사용자의 브랜드 정보가 포함된 OAuth 동의 화면을 브랜드라고 합니다. 브랜드는 내부 사용자 또는 공개 사용자로 제한될 수 있습니다. 내부 브랜드를 사용하면 프로젝트와 동일한 Google Workspace 조직에 속한 사용자가 OAuth 흐름에 액세스할 수 있습니다. 공개 브랜드는 인터넷의 모든 사용자가 OAuth 흐름을 사용할 수 있게 합니다.
브랜드를 API를 통해 수동 또는 프로그래매틱 방식으로 만들 수 있습니다. API로 만든 브랜드는 다른 설정으로 자동 구성됩니다.
OAuth 동의 화면 페이지에서 필요한 정보를 입력한 다음 제출하여 확인받기를 클릭합니다.
확인 절차에 최대 몇 주 정도 걸릴 수 있으며 처리되면 이메일 업데이트가 전송됩니다.
확인에 대해 자세히 알아보기. 확인 절차가 진행되는 동안 Google Workspace 조직 내에서 계속 애플리케이션을 사용할 수 있습니다.
애플리케이션이 확인되기 전에 어떻게 작동하는지 자세히 알아보기.
시작하기 전에
클라이언트를 만들려면 먼저 호출자에게 다음 권한이 부여되었는지 확인합니다.
clientauthconfig.brands.list
clientauthconfig.brands.create
clientauthconfig.brands.get
clientauthconfig.clients.create
clientauthconfig.clients.listWithSecrets(보안 비밀이 있는 OAuth 클라이언트를 나열하는 경우에만 필요)
clientauthconfig.clients.getWithSecret
clientauthconfig.clients.delete
clientauthconfig.clients.update
이러한 권한은 편집자(roles/editor) 및 소유자(roles/owner) 기본 역할에 포함되지만 대신 이러한 권한이 포함된 커스텀 역할을 만들어 호출자에게 부여하는 것이 좋습니다.
IAP용 OAuth 설정
다음 단계는 동의 화면을 구성하고 IAP에 대한 oauth 클라이언트를 만드는 방법을 설명합니다.
동의 화면 구성
list 명령어를 사용하여 기존 브랜드가 있는지 확인합니다. 프로젝트당 하나의 브랜드만 있을 수 있습니다.
supportEmail: OAuth 동의 화면에 표시되는 지원 이메일.
이 이메일 주소는 사용자의 주소이거나 Google 그룹스 별칭입니다.
서비스 계정에도 이메일 주소가 있지만 실제 유효한 이메일 주소가 아니며 브랜드를 만들 때 사용할 수 없습니다. 그러나 서비스 계정은 Google 그룹의 소유자일 수 있습니다. 새 Google 그룹을 만들거나 기존 그룹을 구성하고 원하는 서비스 계정을 그룹의 소유자로 설정합니다.
[[["이해하기 쉬움","easyToUnderstand","thumb-up"],["문제가 해결됨","solvedMyProblem","thumb-up"],["기타","otherUp","thumb-up"]],[["이해하기 어려움","hardToUnderstand","thumb-down"],["잘못된 정보 또는 샘플 코드","incorrectInformationOrSampleCode","thumb-down"],["필요한 정보/샘플이 없음","missingTheInformationSamplesINeed","thumb-down"],["번역 문제","translationIssue","thumb-down"],["기타","otherDown","thumb-down"]],["최종 업데이트: 2025-05-01(UTC)"],[[["\u003cp\u003eThis guide outlines how to programmatically create OAuth clients for Identity-Aware Proxy (IAP) to enable end-to-end setup for internal applications.\u003c/p\u003e\n"],["\u003cp\u003eOAuth clients created via the API are specifically for IAP usage, cannot be modified through the Google Cloud console, and have limited attributes, such as redirect URIs that can not be updated.\u003c/p\u003e\n"],["\u003cp\u003eAPI-created brands for OAuth consent screens are initially set to internal and "unreviewed," requiring manual adjustment to public and submission for a brand review, which will halt the creation of new clients when changed.\u003c/p\u003e\n"],["\u003cp\u003eBefore creating clients, ensure the caller has the required permissions like \u003ccode\u003eclientauthconfig.brands.list\u003c/code\u003e and \u003ccode\u003eclientauthconfig.clients.create\u003c/code\u003e, and that you have a Google Group setup with a valid service account.\u003c/p\u003e\n"],["\u003cp\u003eThe API allows only 500 OAuth clients to be created per project.\u003c/p\u003e\n"]]],[],null,["# Programmatically creating OAuth clients for IAP\n\nThis page describes how to programmatically create OAuth clients for use with\nIAP, enabling you to set up IAP\nprogrammatically end-to-end for internal applications.\n\nKnown limitations\n-----------------\n\nThere are a few limitations for OAuth clients created programmatically\nusing this API:\n\n- OAuth clients created by the API can only be modified by using the API. You cannot modify an OAuth client via the Google Cloud console if it was created by using the API.\n- The OAuth clients created by the API are locked for IAP usage only, and therefore the API does not allow any updates to the redirect URI or other attributes.\n- The API does not operate on the OAuth clients that were created using the Google Cloud console.\n- Only 500 OAuth clients are allowed per project when using the API.\n- API-created OAuth consent screen brands have specific limitations. See the [section below](#branding) for more information.\n\nUnderstanding brands and branding state\n---------------------------------------\n\nThe [OAuth consent screen](https://console.cloud.google.com/apis/credentials/consent),\nwhich contains branding information for users, is known as a **brand**. Brands\ncan be limited to internal users or public users. An internal brand makes the\nOAuth flow accessible to someone who belongs to the same Google Workspace\norganization as the project. A public brand makes the OAuth flow available to\nanyone on the internet.\n\nBrands can be created manually or programmatically via an API. API-created\nbrands are automatically configured with different settings:\n\n- They're set to internal and must be manually set to public if desired\n- They're set to an \"unreviewed\" state and a brand review must be triggered\n\nTo manually set an internal brand to public:\n\n1. Open the [OAuth consent screen](https://console.cloud.google.com/apis/credentials/consent).\n2. Select your desired project from the drop-down menu.\n3. On the **OAuth consent screen** page, note that the **User Type** is automatically set to **Internal** . To set it to **Public** , click **Edit App**. More configuration options become available.\n4. Under **Application type** , click **Public**.\n\n| **Note:** When an API-created internal brand is set to public, the [`identityAwareProxyClients.create()`](/iap/docs/reference/rest/v1/projects.brands.identityAwareProxyClients/create) API will stop working, as it requires the brand to be set to internal. Therefore, you cannot create new OAuth clients via the API after an internal brand is made public.\n\nTo trigger a brand review for an unreviewed API-created brand:\n\n1. Open the [OAuth consent screen](https://console.cloud.google.com/apis/credentials/consent).\n2. Select your desired project from the drop-down menu.\n3. On the **OAuth consent screen** page, enter any required information, and then click **Submit for verification**.\n\nThe verification process may take up to several weeks, and you will receive\nemail updates as it progresses.\n[Learn more](https://support.google.com/cloud/answer/9110914?hl=en) about\nverification. While the verification process is ongoing, you can still use the\napplication within your Google Workspace organization.\n[Learn more](https://support.google.com/cloud/answer/7454865?hl=en_US) about how\nyour application will behave before it's verified.\n\nBefore you begin\n----------------\n\nBefore you can create a client, first ensure that the caller has been granted\nthe following permissions:\n\n- `clientauthconfig.brands.list`\n- `clientauthconfig.brands.create`\n- `clientauthconfig.brands.get`\n- `clientauthconfig.clients.create`\n- `clientauthconfig.clients.listWithSecrets` (Only required for listing OAuth clients with secret.)\n- `clientauthconfig.clients.getWithSecret`\n- `clientauthconfig.clients.delete`\n- `clientauthconfig.clients.update`\n\nThese permissions are included in the Editor (`roles/editor`) and Owner\n(`roles/owner`) [basic roles](/iam/docs/understanding-roles#basic),\nhowever we recommend that you create a\n[custom role](/iam/docs/understanding-roles#custom_roles) that contains these\npermissions and grant it to the caller instead.\n\nSet up OAuth for IAP\n--------------------\n\nThe following steps describe how to configure the consent screen and create and\noauth client for IAP.\n\n### Configuring consent screen\n\n1. Check if you already have an existing brand by using the\n [list](/sdk/gcloud/reference/iap/oauth-brands/list) command. You may\n only have one brand per project.\n\n ```bash\n gcloud iap oauth-brands list\n ```\n\n The following is an example gcloud response, if the brand exists: \n\n name: projects/[PROJECT_NUMBER]/brands/[BRAND_ID]\n applicationTitle: [APPLICATION_TITLE]\n supportEmail: [SUPPORT_EMAIL]\n orgInternalOnly: true\n\n | **Note:** If a brand already exists for a project and has been configured for external users (`orgInternalOnly: false`), but you want to restrict it to internal users, you must make that change manually from the [OAuth consent screen](https://console.cloud.google.com/auth/audience) in order to create OAuth clients with this API.\n2. If no brand exists, use the\n [create](/sdk/gcloud/reference/iap/oauth-brands/create) command:\n\n ```bash\n gcloud iap oauth-brands create --application_title=APPLICATION_TITLE --support_email=SUPPORT_EMAIL\n ```\n\n\n The above fields are required when calling this API:\n - `supportEmail`: The support email displayed on the OAuth consent screen.\n This email address can either be a user's address or a Google Groups alias.\n While service accounts also have an email address, they are not actual\n valid email addresses, and cannot be used when creating a brand. However,\n a service account can be the owner of a Google Group. Either create a\n new Google Group or configure an existing group and set the desired service\n account as an owner of the group.\n\n | **Note:** The user issuing the request must be an owner of the specified support email address.\n - `applicationTitle`: The application name displayed on OAuth consent\n screen.\n\n The response contains the following fields: \n\n name: projects/[PROJECT_NUMBER]/brands/[BRAND_ID]\n applicationTitle: [APPLICATION_TITLE]\n supportEmail: [SUPPORT_EMAIL]\n orgInternalOnly: true\n\n### Creating an IAP OAuth Client\n\n1. Use the create command to\n [create](/sdk/gcloud/reference/iap/oauth-clients/create) a client. Use\n the brand `name` from previous step.\n\n ```bash\n gcloud iap oauth-clients create projects/PROJECT_NUMBER/brands/BRAND-ID --display_name=NAME\n ```\n\n The response contains the following fields: \n\n name: projects/[PROJECT_NUMBER]/brands/[BRAND_NAME]/identityAwareProxyClients/[CLIENT_ID]\n secret: [CLIENT_SECRET]\n displayName: [NAME]\n\nUse the client ID (`client_id` in the above example) and `secret` to enable\nIAP. See the following topics for more information about\nenabling IAP using the credentials you've just created:\n\n- [IAP for Kubernetes Engine](/iap/docs/enabling-kubernetes-howto)\n- [IAP for App Engine](/iap/docs/app-engine-quickstart)\n- [IAP for Compute Engine](/iap/docs/enabling-compute-howto)\n- [IAP for Cloud Run](/iap/docs/enabling-cloud-run)"]]
